If you discover a security vulnerability in Supergraph, please report it privately:

1. Do not open a public issue or discussion for the vulnerability.
2. Email the maintainer at datit309@gmail.com with the details.
3. Include the affected platform (Claude Code, Antigravity CLI, Codex CLI, or OpenCode), skill/hook name, and reproduction steps or proof-of-concept.
4. Include any suggested mitigations or patches if available.

• Initial Acknowledgment: Within 48 hours
• Triage & Assessment: Within 7 days
• Fix & Advisory Release: Handled with priority based on severity

This security policy applies to:

• The Supergraph plugin manifests, skills, agents, and lifecycle hooks
• Installation scripts (install.sh, install.ps1)
• CI/CD workflow configurations maintained in this repository

• All graph intelligence and LSP tools execute locally (local-first). No telemetry or codebase data is uploaded to remote servers.
• When running hooks or scripts, ensure tool and shell commands are inspected before execution.
• Avoid committing secrets, API keys, or personal tokens to repository environments.